Quantum cryptography using balanced homodyne detection 
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We report an experimental quantum key distribution that utilizes balanced homodyne detection, 
instead of photon counting, to detect weak pulses of coherent light. Although our scheme inherently 
has a finite error rate, it allows high-efficiency detection and quantum state measurement of the 
transmitted light using only conventional devices at room temperature. When the average photon 
number was 0.1, an error rate of 0.08 and "effective" quantum efficiency of 0.76 were obtained. 
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According to quantum mechanics, one cannot obtain 
information about a single quantum system without dis- 
turbing its state [0 nor can one clone an unknown state 
1^. Quantum cryptography is a technique for realiz- 
ing secure communications exploiting these principles. 
The most popular protocol is quantum key distribution 
(QKD) in which two non-orthogonal states (B92 proto- 
col) 1^ or four states (BB84 protocol) Q are sent via 
a quantum channel in order to generate random keys 
owned only by the legitimate sender (usually called Al- 
ice) and the receiver (Bob). These keys are then used to 
encode messages. 

In practice, a faint laser pulse is usually used as the 
quantum system, and keys are encoded by its polariza- 
tion or its phase. Ideally, a single photon is desirable, 
but it is very difficult to generate it experimentally. Most 
of the previous experimental and theoretical studies on 
QKD used or postulated photon counting as a means to 
detect weak light. However, the usage of photon counting 
gives rise to two limitations. One is a technical limitation 
that at present there exists no efficient photon counter for 
infrared light, especially for 1.55-/im where optical loss 
in an optical fiber is minimum. State-of-the-art experi- 
ments used a specially designed photon-counting system 
made up of cooled avalanche photo diode operated in a 
gated Geiger mode |||, ||, |^. For example, a quantum effi- 
ciency of 7% for 1.55/Ltm with a dark-count probability of 
10^^ per 2.6-nsec time- window was reported . Another 
limitation is a more fundamental: the quantum state of 
the transmitted light cannot be directly measured; the 
state alternation is inferred only from the change of the 
error rate. For example, when the eavesdropper (usu- 
ally called Eve) changes the photon number distribution 
of the transmitted light while keeping the polarization 
(or the phase) and the mean photon number. Bob can- 
not notice the presence of Eve. This feature allows Eve 
to perform many kinds of attacks and leads to security 
holes (one example is the photon number splitting attack 
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In this paper, we propose using balanced homodyne de- 
tection for implementing the BB84 protocol with phase 
coding |]l0| . As we will explain, the above limitations 
associated with photon counting can be resolved by us- 
ing balanced homodyne detection. In order to demon- 
strate the experimental feasibility of our scheme, we 
have performed QKD by sending light pulses at 1.55- 
/im wavelength through an optical fiber of 20-cm length. 
When the average photon number was 0.1, a bit-error- 
rate (BER) of 0.08 and "effective" quantum efficiency 
of 0.76 were obtained (effective detection efficiency was 
0.076). 

Balanced homodyne detection (sometimes called 
quadrature phase homodyne measurement) is a well- 
established quantitative method for measuring the 
quadrature-amplitude operator of the radiation field 
]ll| , 12 . It has been developed as a means of detect- 
ing reduced quadrature-amplitude fluctuations (squeezed 
states of light) In this method, a weak signal field 

interferes with a strong local oscillator (LO) on a beam 
splitter, and the difference of the intensities of the two 
outputs of the beam splitter is measured. When the LO is 
much stronger than the signal, the output of the balanced 
homodyne detector is proportional to the quadrature- 
amplitude operator of the signal field . This is a very 
efficient method for measuring the quadrature amplitude 
of the signal, although no information on the conjugate 
quadrature is obtained. 

In 1993, Smithey et al. demonstrated the determina- 
tion of the Wigner distribution and the density matrix of 
a light field by measuring not only the variances but also 
the distributions of the quadrature amplitude of the field. 
They used the so-called optical homodyne tomography 
(OHT) method in which the inverse Radon transform of 
the distributions was calculated. A measurement of the 
density matrix provides all knowable information allowed 
by quantum mechanics. For example, photon number 
statistics can be calculated from the density matrix. Of 
course, it is impossible to measure the density matrix of 
a single quantum system; we need the ensembles of the 
same quantum state. Such ensembles can be prepared by 
randomly switching the QKD and OHT procedure at the 
cost of a lowered transmission rate. However, even with- 
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FIG. 1: Theoretical probability distributions of the quadra- 
ture amplitude for total phase shifts are 0°, 90°, 180°, and 
270°. The signal photon number is 1 photon/pulse. 



out the OHT, distributions of the quadrature amplitude 
for some phases are obtained in the QKD procedure, thus 
limiting the range of allowable eavesdropping strategies. 

Note that if a QKD protocol uses a phase coding rela- 
tive to bright light as proposed in Eve as well as 
Bob can perform balanced homodyne detection, although 
such possibilities have seldom been discussed so far. Also 
from this viewpoint, it is important to investigate QKD 
using balanced homodyne detection. Recently, several 
authors have presented quantum cryptography using ho- 
modyne detection . These proposals use EPR- 
type correlation or squeezed states. Our scheme uses only 
coherent states so that experimental realization is much 
easier. 

We will now explain our implementation of QKD in 
more detail. The protocol is basically an interferometric 
QKD using four nonorthogonal states Laser pulses 
are split by an unsymmetrical beam splitter into two 
arms of a Mach-Zehnder interferometer. Pulses in one 
arm, which we will call the local oscillator (LO), contain 
many photons (typically ulo ~ 10^ photon/pulse), and 
pulses in the other arm, which we will call the signal, con- 
tain photons at quantum level {rigig < 1 photon/pulse). 
Alice apphes a random (f>A^O°-, 90°-, 180°-, and 270°- 
phase shift to the signal; Bob, a random (ps—O"-, 90°- 
phase shift to the LO. Bob, then, performs balance ho- 
modyne detection. To put it concretely. Bob combines 
the signal field with the LO field by a 50-50 beam split- 
ter. Two photodiodes are used to monitor the intensities 
from two output ports. Finally, the two photodiode out- 
puts are subtracted, and the difference of photoelectrons 
is measured. We denote the total phase shift between 
the signal and the LO hy 4> — 4> a — 4>b- 

The normalized quadrature amplitude of the signal 
X = [cLsig -I- al^g)/2 is obtained by = N^/2^nLOi 
where asig is the annihilation operator of the signal. For 
each pulse, takes a random value due to quantum 



fluctuations. Theoretically, the probability distribution 
P{X(j,) is given by integrating the Wigner distribution 
over the conjugate variable X^+goo |l9). When the sig- 
nal is in a coherent state, P{Xtp) is given by a Gaussian 
function with a standard deviation of 1/2. Figure ^ shows 
P{X^) for (/)=0°, 90°, 180°, and 270° when the aver- 
age signal photon number is 1 . The probability distribu- 
tion for 0=90°, P(A:go), and that for 0=270° ,P{X27o), 
are the same, so it is impossible to differentiate them; 
in this case, Bob selected the wrong basis. It is, how- 
ever, possible to differentiate 0=0° from 0=180°. To do 
this. Bob sets up two threshold values X+ and X^ where 
X- < X+. In the following, we set X^ — —X+. If the 
measured quadrature amplitude AT^ is larger than A+ 
(in this case, we say that Bob's result is positive). Bob 
judges that 0=0°. If A^ is smaller than A_ (Bob's result 
is negative). Bob judges that 0=180°. Finally, if A^ is 
between A_ and A+ (Bob gets an inconclusive result). 
Bob abandons the judgement. Note that because ^'(Ao) 
overlaps P(Ai8o), Bob's judgement is not always true. 
This intrinsic bit error rate eint is the probability that 
is actually 180° even when Bob's result is positive, or 
0=0° for Bob's negative result. The larger X+ is the 
smaller Cint becomes, but at the same time the proba- 
bility, Pine, that Bob gets inconclusive results becomes 
larger. We define "effective" detection efficiency pd as 
the probability that Bob gets positive or negative results 
(pd = 1 —pinc)- A remarkable feature of our implemen- 
tation of QKD is that both Cmt and pd are functions 
of the Hsig and A-|_. The values of eint and pd can be 
easily calculated by using the error function. For exam- 
ple, when nsig=l and A_|_=A_=0, ei„t=0.023 andpd=l. 
If we choose A+ =— A_=0.5, eint is greatly reduced to 
0.0016 while pd—O.SA changes a little. When ?2sig—0-^ 
and A+=-A_ = l, e„t=0.047 and ]3d=0.090. In order 
to compare the performance of our scheme to that of 
the photon counting scheme, we define "effective" quan- 
tum efficiency rid=Pd/nsig. In the last case, therefore, 
77d=0.90. These values demonstrate the excellent per- 
formance of balanced homodyne detection. For a given 
value of risig there exists an optimal A+ ( A_ ) that max- 
imizes the mutual information between Alice and Eve 




After an appropriate number of pulses have been trans- 
ferred. Bob tells Alice which phase shift he applied for 
each pulse. Alice, then, tells Bob which phase shifts were 
correct. The correctly measured data is interpreted as a 
binary sequence according to the coding scheme (0^1=0° 
or 90°)=1 and (0a=18O° or 270°)=0 for Alice, and (pos- 
itive result)=l and (negative result)=0 for Bob. Finally, 
Alice and Bob perform error correction and privacy am- 
plification procedures. 

Let us now consider the security of this system. Here 
we stress the advantage of the homodyne scheme that 
permits the measurement of quadrature amplitude dis- 
tributions. A detailed analysis is presented in a sepa- 
rate paper pO| . In the intercept-resend eavesdropping 
strategy. Eve intercepts selected light pulses and mea- 
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sures them, and then sends an appropriate state to Bob. 
In the photon counting scheme, she can send a vacuum 
state (send nothing) for some pulses and send a higher 
intensity state for remaining pulses if the net rate of 
detection by Bob is unchanged In the homodyne 
scheme, however, this is not the case because such inter- 
vention changes the probability distribution of the mea- 
sured quadrature amplitudes. In order to detect such 
changes. Bob graphs two probability distributions: one 
is for pulses for which he selected the correct basis (0=0° 
or 180°), the other is for pulses for which he selected the 
wrong basis {(f> — 90° or 270°). If, for example, Eve sends 
vacuum pulses, Bob's probability distribution for the cor- 
rect basis becomes a superposition of Gaussians not only 
centered at but also centered at The reso- 

lution of the quadrature-amplitude distribution becomes 
higher as the number of pulses increases. Therefore, al- 
lowable eavesdropping strategies will be limited. Note 
that since nonlinear optical processes, such as amplifica- 
tion or parametric processes, generally change the quan- 
tum state of light, sophisticated eavesdropping strategies 
would be detectable. 

For Eve's intercept-resend eavesdropping to succeed. 
Eve must determine Alice's phase shift with high accu- 
racy. It is clear, however, that, iiusig is sufficiently small, 
Eve cannot do that. She may take primarily two mea- 
surement schemes: she may measure the signal in the 
basis of her choosing as Bob does, or she may measure it 
in both bases by splitting it into two parts using a 50-50 
beam splitter and measuring with 0°-phase shift at one 
output and with 90°-phase shift at the other. For the for- 
mer case, she obtains no information for half of pulses. 
For the latter case, because the simultaneous measure- 
ment of two noncommuting observables introduces extra 
noise ^ , her error rate is larger than the one for the 
single basis measurement. For example, when nsig = l, 
the probability that she correctly differentiates between 
four phase shifts is only 0.708 (we assume that she must 
always choose one phase shift) [ pO[ . 

If there is an optical loss in the communication chan- 
nel (this is always true for long distance transmission), 
Eve can, in principle, replace the original channel with a 
more transparent one, and then put a beam splitter on 
the channel. This beamsplitting attack does not change 
the state of the transmitted light so Bob cannot detect 
the presence of Eve. Moreover, because Eve can stay 
closer to Alice than Bob, the signal intensity at Eve's 
port will be higher than the one at Bob's port. How- 
ever, even when Eve's signal-to-noise ratio is better than 
Bob's, Eve cannot get full information due to quantum 
fluctuations. In addition. Bob can improve his error rate 
by discarding pulses (by increasing X^.). Eve, on the 
other hand, cannot improve her error rate for Bob's se- 
lected pulses because Eve's measurement result is uncor- 
related with Bob's due to quantum fluctuations entering 
from the dark port of the beam splitter. Therefore, Eve's 
Shannon information on the final key could be reduced 
to an arbitrarily small value by privacy amplification. 
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FIG. 2: Experimental setup. We used a four-state proto- 
col (BB84) in which keys are encoded in the phase difference 
between two pulses: (0°,180°) or (90°, 270°). In the transmis- 
sion fiber, two pulses have mutually orthogonal polarization 
and are delayed by 500-psec. The light source is a 1.55-mm- 
wavelength semiconductor laser. 



In order to demonstrate the feasibility of our scheme, 
we performed a prototype QKD experiment. The exper- 
imental setup is shown in Fig. ^. The light source is 
a 1.55-/im-wavelength semiconductor laser (Pico-Quanta 
model PDL-800) that generates ^100-ps-duration pulses 
whose repetition rate can be controlled by a PC. The 
laser output is split by a half- wave plate (A/ 2) and a 
polarizing beam splitter (PBS) into the signal and LO 
pulse. The signal pulse is attenuated to a single-photon 
level, and its phase can be varied by moving a mirror 
with a piezoelectric transducer (PZT). We use time and 
polarization division to separate the signal and the LO in 
a transmission fiber Q. A quarter-wave plate (A/4) and 
a half-wave plate are used to control the polarization of 
the signal and the LO after they traverse the fiber. The 
signal and LO overlap each other in time on the sec- 
ond PBS. Their polarizations are then rotated by 45° 
so they interfere on the third PBS. The balanced detec- 
tor consists of two InGaAs PDs (Hamamatsu photonics 
model G3476-03) and a charge-sensitive amplifier (Digi- 
tex model IIIC-1576 [^). The quantum efficiency of the 
PD, rjPD, was measured to be 0.85±0.03. The detector 
output is recorded by an A/D board installed in a PC. 
The overall electronic detection noise was 1010 electrons 
rms. The phase drift of our interferometer was less than 
A/10 in 10-seconds. The fringe visibility V was 0.8 and 
was limited by imperfect spatial overlap between the sig- 
nal and the LO. 

Figure || shows the measured P{X^) for 0=0°, 90°, 



180°, and 270° 



''Sig 



was 0.1 photons/pulse, and tilo was 



2x10^ photons/pulse. There was a total of 10"^ pulses. It 
took about 1-min to send lO'^-pulses; the repetition rate 
of the laser was set very low because the response time 
for moving a mirror with PZT was slow. Use of electro- 
optical modulator will enable us to increase the repeti- 
tion rate and decrease the phase error. The mean and 
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TABLE I: Mean and standard deviations of measured P{X^) 






Mean 


Standard deviation 


0° 


0.230± 0.022 


0.585± 0.023 


90° 


-0.060± 0.018 


0.552± 0.018 


180° 


-0.227± 0.038 


0.562± 0.038 


270° 


0.022± 0.050 


0.0634± 0.051 



0.16 
0.12 
0.08 
0.04 
0.00 




-1 



1 





FIG. 3: The measured distributions of the quadrature am- 
phtude of the signal for different total phase-shifts between 
the signal and the LO pulse (0°, 90°, 180°, and 270°). Total 
number of pulses is 10'^. The signal intensity was 0.1 pho- 
tons/pulse, the LO intensity was 2x10*' photons/pulse, and 
the fringe visibility of the interferometer was 0.8 (limited by 
spatial overlap). 



the standard deviations of the distributions are shown 
in Table 1. The measured values of the mean are con- 



sistent with theoretical values of ±^nsigr]p]jV=± 0.23. 
The standard deviations are large than the ideal value of 
0.5 mainly due to the amplifier noise. 

QKD was performed using the same data as shown in 
Fig. I Bob selected the correct basis (0 = 0° or 180°) 
for 490 pulses. For X+=0, pd=l and BER was 0.34. For 
X+=0.98, prf=0.076 (?7d=0.76) and BER was 0.081. Al- 
though these values are worse than the ideal estimation 
shown above, they still demonstrate the superior perfor- 
mance of our scheme, and will be improved in the future 
by using a fiber-optics-based interferometer, a low-noise, 
high-speed, charge-sensitive amplifier, and so on. Note 
that because for Eve nsig=l is already too low to ef- 
fectively perform eavesdropping and for Bob Usig— 0.1 is 
high enough to perform QKD, our scheme would be fea- 
sible in the presence of 10-dB optical loss. 

In conclusion, we have presented a novel scheme for 
QKD that utilizes balanced homodyne detection in the 
phase-encoding BB84 protocol. The scheme has an inher- 
ently finite error rate, but previous schemes also have fi- 
nite error rates in practice. The advantage of our scheme 
is that measuring the distributions of quadrature ampli- 
tudes limits the allowable eavesdropping strategies. In 
addition, if Alice randomly adds auxiliary phase-shift, 
the density matrix of the signal could be measured by op- 
tical homodyne tomography. We have performed a pro- 
totype QKD experiment at 1.55-/im wavelength. When 
the average photon number was 0.1, a BER of 0.08 and 
"effective" quantum efficiency of 0.76 were obtained (ef- 
fective detection efficiency was 0.076). 
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ment. T. H. acknowledges the financial support from the 
Research Foundation for Opto-Science and Technology. 
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